CVE-2019-19922
Published: 22 December 2019
kernel/sched/fair.c in the Linux kernel before 5.3.9, when cpu.cfs_quota_us is used (e.g., with Kubernetes), allows attackers to cause a denial of service against non-cpu-bound applications by generating a workload that triggers unwanted slice expiration, aka CID-de53fd7aedb1. (In other words, although this slice expiration would typically be seen with benign workloads, it is possible that an attacker could calculate how many stray requests are required to force an entire Kubernetes cluster into a low-performance state caused by slice expiration, and ensure that a DDoS attack sent that number of stray requests. An attack does not affect the stability of the kernel; it only causes mismanagement of application execution.)
From the Ubuntu Security Team
It was discovered that in some situations the fair scheduler in the Linux kernel did not permit a process to use its full quota time slice. A local attacker could use this to cause a denial of service.
Priority
Status
Package | Release | Status |
---|---|---|
linux Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-69.78)
|
disco |
Released
(5.0.0-38.41)
|
|
eoan |
Released
(5.3.0-24.26)
|
|
focal |
Not vulnerable
(5.4.0-9.12)
|
|
trusty |
Not vulnerable
(3.11.0-12.19)
|
|
upstream |
Released
(5.4~rc1)
|
|
xenial |
Not vulnerable
(4.2.0-16.19)
|
|
Patches: Introduced by 512ac999d2755d2b7109e996a76b6fb8b888631d |
||
linux-aws Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1054.56)
|
disco |
Released
(5.0.0-1023.26)
|
|
eoan |
Released
(5.3.0-1008.9)
|
|
focal |
Not vulnerable
(5.4.0-1005.5)
|
|
trusty |
Not vulnerable
(4.4.0-1002.2)
|
|
upstream |
Released
(5.4~rc1)
|
|
xenial |
Not vulnerable
(4.4.0-1001.10)
|
|
linux-aws-5.0 Launchpad, Ubuntu, Debian |
bionic |
Released
(5.0.0-1023.26~18.04.1)
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.4~rc1)
|
|
xenial |
Does not exist
|
|
linux-azure-edge Launchpad, Ubuntu, Debian |
bionic |
Ignored
(end of life, was needs-triage)
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.4~rc1)
|
|
xenial |
Ignored
(end of standard support, was needs-triage)
|
|
linux-gcp Launchpad, Ubuntu, Debian |
bionic |
Released
(5.0.0-1028.29~18.04.1)
|
disco |
Released
(5.0.0-1028.29)
|
|
eoan |
Released
(5.3.0-1009.10)
|
|
focal |
Not vulnerable
(5.4.0-1005.5)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.4~rc1)
|
|
xenial |
Released
(4.15.0-1049.52)
|
|
linux-gke-5.3 Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(5.3.0-1011.12~18.04.1)
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.4~rc1)
|
|
xenial |
Does not exist
|
|
linux-oem-5.6 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
eoan |
Does not exist
|
|
focal |
Not vulnerable
(5.4.0-1002.4)
|
|
trusty |
Does not exist
|
|
xenial |
Does not exist
|
|
upstream |
Released
(5.4~rc1)
|
|
linux-oracle-5.3 Launchpad, Ubuntu, Debian |
eoan |
Does not exist
|
bionic |
Not vulnerable
(5.3.0-1011.12~18.04.1)
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.4~rc1)
|
|
xenial |
Does not exist
|
|
linux-aws-hwe Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.4~rc1)
|
|
xenial |
Released
(4.15.0-1054.56~16.04.1)
|
|
linux-azure Launchpad, Ubuntu, Debian |
bionic |
Released
(5.0.0-1027.29~18.04.1)
|
disco |
Released
(5.0.0-1027.29)
|
|
eoan |
Released
(5.3.0-1008.9)
|
|
focal |
Not vulnerable
(5.4.0-1006.6)
|
|
trusty |
Released
(4.15.0-1063.68~14.04.1)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
upstream |
Released
(5.4~rc1)
|
|
xenial |
Released
(4.15.0-1063.68)
|
|
linux-azure-5.3 Launchpad, Ubuntu, Debian |
bionic |
Released
(5.3.0-1008.9~18.04.1)
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.4~rc1)
|
|
xenial |
Does not exist
|
|
linux-gcp-5.3 Launchpad, Ubuntu, Debian |
bionic |
Released
(5.3.0-1009.10~18.04.1)
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.4~rc1)
|
|
xenial |
Does not exist
|
|
linux-gcp-edge Launchpad, Ubuntu, Debian |
bionic |
Ignored
(end of life, was needs-triage)
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.4~rc1)
|
|
xenial |
Does not exist
|
|
linux-gke-4.15 Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1048.51)
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.4~rc1)
|
|
xenial |
Does not exist
|
|
linux-gke-5.0 Launchpad, Ubuntu, Debian |
bionic |
Released
(5.0.0-1027.28~18.04.1)
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.4~rc1)
|
|
xenial |
Does not exist
|
|
linux-hwe Launchpad, Ubuntu, Debian |
bionic |
Released
(5.3.0-26.28~18.04.1)
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.4~rc1)
|
|
xenial |
Released
(4.15.0-69.78~16.04.1)
|
|
linux-hwe-edge Launchpad, Ubuntu, Debian |
bionic |
Ignored
(end of life, was needs-triage)
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.4~rc1)
|
|
xenial |
Ignored
(end of life, was needs-triage)
|
|
linux-kvm Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1050.50)
|
disco |
Released
(5.0.0-1024.26)
|
|
eoan |
Released
(5.3.0-1008.9)
|
|
focal |
Not vulnerable
(5.4.0-1004.4)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.4~rc1)
|
|
xenial |
Not vulnerable
(4.4.0-1004.9)
|
|
linux-lts-trusty Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.4~rc1)
|
|
xenial |
Does not exist
|
|
linux-lts-xenial Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Not vulnerable
(4.4.0-13.29~14.04.1)
|
|
upstream |
Released
(5.4~rc1)
|
|
xenial |
Does not exist
|
|
linux-oem Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1063.72)
|
disco |
Ignored
(end of life)
|
|
eoan |
Released
(4.15.0-1063.72)
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.4~rc1)
|
|
xenial |
Ignored
(end of standard support, was needs-triage)
|
|
linux-oem-osp1 Launchpad, Ubuntu, Debian |
bionic |
Released
(5.0.0-1033.38)
|
disco |
Ignored
(end of life)
|
|
eoan |
Released
(5.0.0-1033.38)
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.4~rc1)
|
|
xenial |
Does not exist
|
|
linux-oracle Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1029.32)
|
disco |
Released
(5.0.0-1009.14)
|
|
eoan |
Released
(5.3.0-1007.8)
|
|
focal |
Not vulnerable
(5.4.0-1005.5)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.4~rc1)
|
|
xenial |
Released
(4.15.0-1029.32~16.04.1)
|
|
linux-oracle-5.0 Launchpad, Ubuntu, Debian |
bionic |
Released
(5.0.0-1009.14~18.04.1)
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.4~rc1)
|
|
xenial |
Does not exist
|
|
linux-raspi2 Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1050.54)
|
disco |
Released
(5.0.0-1024.25)
|
|
eoan |
Released
(5.3.0-1014.16)
|
|
focal |
Ignored
(end of life, was needed)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.4~rc1)
|
|
xenial |
Not vulnerable
(4.2.0-1013.19)
|
|
linux-raspi2-5.3 Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(5.3.0-1017.19~18.04.1)
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.4~rc1)
|
|
xenial |
Does not exist
|
|
linux-snapdragon Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1067.74)
|
disco |
Ignored
(end of life, was pending)
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.4~rc1)
|
|
xenial |
Not vulnerable
(4.4.0-1012.12)
|
Severity score breakdown
Parameter | Value |
---|---|
Base score | 5.5 |
Attack vector | Local |
Attack complexity | Low |
Privileges required | Low |
User interaction | None |
Scope | Unchanged |
Confidentiality | None |
Integrity impact | None |
Availability impact | High |
Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19922
- https://git.kernel.org/linus/de53fd7aedb100f03e5d2231cfce0e4993282425
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.9
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=de53fd7aedb100f03e5d2231cfce0e4993282425
- https://github.com/kubernetes/kubernetes/issues/67577
- https://github.com/torvalds/linux/commit/de53fd7aedb100f03e5d2231cfce0e4993282425
- https://relistan.com/the-kernel-may-be-slowing-down-your-app
- https://ubuntu.com/security/notices/USN-4226-1
- NVD
- Launchpad
- Debian